Implement automated AUR release workflow

.github/workflows/publish-aur.yml

@@ -0,0 +1,176 @@
+name: Publish to AUR
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Git tag to build (e.g., v0.3.0)'
+        required: true
+        type: string
+      package:
+        description: 'AUR package name'
+        required: false
+        default: 'siomon'
+        type: string
+  workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
+      package:
+        required: false
+        default: 'siomon'
+        type: string
+    secrets:
+      AUR_SSH_PRIVATE_KEY:
+        required: true
+      PKG_GIT_NAME:
+        required: true
+      PKG_GIT_EMAIL:
+        required: true
+
+jobs:
+  publish:
+    name: Build and push to AUR
+    runs-on: ubuntu-latest
+    container: archlinux:base-devel
+    steps:
+      - name: Install dependencies
+        run: pacman -Syu --noconfirm git cargo namcap pacman-contrib openssh jq curl
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve tag to commit hash
+        id: resolve
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          UPSTREAM_REPO="https://github.com/level1techs/siomon.git"
+          UPSTREAM_VERSION="${TAG#v}"
+          echo "==> Resolving tag $TAG to commit hash..."
+
+          # Try dereferenced tag first (annotated tags), then lightweight
+          COMMIT_HASH=$(git ls-remote "$UPSTREAM_REPO" "refs/tags/${TAG}^{}" 2>/dev/null | awk '{print $1}')
+          if [ -z "$COMMIT_HASH" ]; then
+            COMMIT_HASH=$(git ls-remote "$UPSTREAM_REPO" "refs/tags/${TAG}" 2>/dev/null | awk '{print $1}')
+          fi
+          if [ -z "$COMMIT_HASH" ]; then
+            echo "::error::Could not resolve tag $TAG from $UPSTREAM_REPO"
+            exit 1
+          fi
+
+          echo "    $TAG -> $COMMIT_HASH"
+          echo "commit_hash=$COMMIT_HASH" >> "$GITHUB_OUTPUT"
+          echo "upstream_version=$UPSTREAM_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch current AUR version
+        id: aur_version
+        env:
+          UPSTREAM_VERSION: ${{ steps.resolve.outputs.upstream_version }}
+          AUR_PACKAGE: ${{ inputs.package }}
+        run: |
+          echo "==> Querying AUR for current ${AUR_PACKAGE} version..."
+          AUR_INFO=$(curl -sL "https://aur.archlinux.org/rpc/v5/info?arg[]=${AUR_PACKAGE}")
+
+          AUR_VERSION=$(echo "$AUR_INFO" | jq -r '.results[0].Version // empty')
+          if [ -z "$AUR_VERSION" ]; then
+            echo "    Package not found on AUR, using pkgrel=1"
+            echo "pkgrel=1" >> "$GITHUB_OUTPUT"
+          else
+            AUR_PKGVER="${AUR_VERSION%-*}"
+            AUR_PKGREL="${AUR_VERSION##*-}"
+            echo "    Current AUR version: ${AUR_PKGVER}-${AUR_PKGREL}"
+
+            if [ "$AUR_PKGVER" = "$UPSTREAM_VERSION" ]; then
+              NEW_PKGREL=$((AUR_PKGREL + 1))
+              echo "    Same upstream version, incrementing pkgrel to $NEW_PKGREL"
+            else
+              NEW_PKGREL=1
+              echo "    New upstream version, using pkgrel=1"
+            fi
+            echo "pkgrel=$NEW_PKGREL" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Prepare PKGBUILD
+        env:
+          UPSTREAM_VERSION: ${{ steps.resolve.outputs.upstream_version }}
+          COMMIT_HASH: ${{ steps.resolve.outputs.commit_hash }}
+          PKGREL: ${{ steps.aur_version.outputs.pkgrel }}
+        run: |
+          # Create non-root builder user (makepkg refuses to run as root)
+          useradd -m builder
+
+          cp packaging/aur/PKGBUILD /home/builder/PKGBUILD
+          cd /home/builder
+
+          # Update version fields
+          sed -i "s/^pkgver=.*/pkgver=${UPSTREAM_VERSION}/" PKGBUILD
+          sed -i "s/^_tag=.*/_tag=${COMMIT_HASH} # git rev-parse \"v\$pkgver\"/" PKGBUILD
+          sed -i "s/^pkgrel=.*/pkgrel=${PKGREL}/" PKGBUILD
+
+          chown builder:builder PKGBUILD
+
+          # Recompute checksums
+          echo "==> Recomputing b2sums..."
+          su builder -c "updpkgsums"
+
+      - name: Build and test
+        run: |
+          cd /home/builder
+          echo "==> Building package..."
+          su builder -c "makepkg -s --noconfirm"
+
+      - name: Generate .SRCINFO
+        run: |
+          cd /home/builder
+          su builder -c "makepkg --printsrcinfo > .SRCINFO"
+
+      - name: Validate with namcap
+        run: |
+          cd /home/builder
+          echo "==> Running namcap validation..."
+          su builder -c "namcap PKGBUILD" || true
+          for pkg in *.pkg.tar.*; do
+            [ -f "$pkg" ] && su builder -c "namcap $pkg" || true
+          done
+
+      - name: Push to AUR
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          PKG_GIT_NAME: ${{ secrets.PKG_GIT_NAME }}
+          PKG_GIT_EMAIL: ${{ secrets.PKG_GIT_EMAIL }}
+          UPSTREAM_VERSION: ${{ steps.resolve.outputs.upstream_version }}
+          AUR_PACKAGE: ${{ inputs.package }}
+        run: |
+          # Set up SSH
+          mkdir -p "$HOME/.ssh"
+          chmod 700 "$HOME/.ssh"
+          echo "$AUR_SSH_PRIVATE_KEY" > "$HOME/.ssh/aur_key"
+          chmod 600 "$HOME/.ssh/aur_key"
+
+          # Pre-populate known_hosts with AUR's SSH host key
+          ssh-keyscan -t ed25519,rsa aur.archlinux.org >> "$HOME/.ssh/known_hosts"
+
+          # Use GIT_SSH_COMMAND to ensure git uses our key and known_hosts
+          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur_key -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+
+          # Configure git identity
+          git config --global user.name "$PKG_GIT_NAME"
+          git config --global user.email "$PKG_GIT_EMAIL"
+
+          # Clone AUR repo, update, commit, push
+          git clone "ssh://aur@aur.archlinux.org/${AUR_PACKAGE}.git" "/tmp/aur-${AUR_PACKAGE}"
+          cd "/tmp/aur-${AUR_PACKAGE}"
+
+          cp /home/builder/PKGBUILD .
+          cp /home/builder/.SRCINFO .
+
+          git add PKGBUILD .SRCINFO
+          if git diff --cached --quiet; then
+            echo "No changes to push."
+          else
+            git commit -m "Update to ${UPSTREAM_VERSION}"
+            git push origin master
+            echo "==> Pushed to AUR successfully."
+          fi

packaging/aur/PKGBUILD

@@ -0,0 +1,46 @@
+# Maintainer: Level1Techs Package Team <level1techspackageteam@gmail.com>
+# Contributor: Ewout van Mansom <ewout@vanmansom.name>
+pkgname=siomon
+pkgver=0.2.2
+pkgrel=1
+pkgdesc="Hardware information and real-time sensor monitoring tool"
+arch=(x86_64 aarch64)
+url="https://github.com/level1techs/siomon"
+license=('MIT')
+depends=('glibc'
+         'libgcc')
+optdepends=('nvidia-utils: GPU name, VRAM, clocks, temp, power, utilization'
+            'dmidecode: Per-DIMM memory details'
+            'msr-tools: CPU TDP, turbo ratios, C-states, perf limiters'
+            'i2c-tools: SPD/XMP memory timing data'
+            'hddtemp: SATA drive temperatures via hwmon')
+makedepends=('git'
+             'cargo')
+options=()
+_tag=2f0b399085de511ff14d8a8a2b69c71f7a40558c # git rev-parse "v$pkgver"
+source=("siomon::git+https://github.com/level1techs/siomon.git#tag=$_tag")
+b2sums=('745141ab3c7a789c271ffa4ed55fab1555ed312c3c2067b32be6b38cf03e0166bbb8aaebcff9957f9eff53dd2fccb91806df53a483752fcd66ce973af72d85a9')
+
+prepare() {
+    cd "$srcdir/$pkgname"
+    export RUSTUP_TOOLCHAIN=stable
+    cargo fetch --locked --target host-tuple
+}
+
+build() {
+    cd "$srcdir/$pkgname"
+    # no-op, cargo install builds for us
+}
+
+check() {
+    cd "$srcdir/$pkgname"
+    export RUSTUP_TOOLCHAIN=stable
+    cargo test --frozen --all-features
+}
+
+package() {
+    cd "$srcdir/$pkgname"
+    export RUSTUP_TOOLCHAIN=stable
+    cargo install --no-track --frozen --all-features --root "$pkgdir/usr/" --path .
+    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

packaging/aur/README.md

@@ -0,0 +1,52 @@
+# AUR Packaging
+
+This directory contains the PKGBUILD template for the
+[Arch User Repository (AUR)](https://aur.archlinux.org/packages/siomon).
+
+## Files
+
+- `PKGBUILD` — Arch Linux package build script. Contains template values for
+  `pkgver`, `_tag`, `pkgrel`, and `b2sums` that are updated automatically by
+  the CI workflow at build time.
+
+## How It Works
+
+The GitHub Actions workflow (`.github/workflows/publish-aur.yml`) runs in an
+`archlinux:base-devel` container and:
+
+1. Resolves the release tag to a full commit hash via `git ls-remote`.
+2. **Queries the AUR API** (`https://aur.archlinux.org/rpc/v5/info`) to
+   determine the currently published version. If the upstream version
+   (`pkgver`) already exists, `pkgrel` is incremented automatically. For a
+   new upstream version, `pkgrel` resets to `1`.
+3. Updates the PKGBUILD with the resolved `pkgver`, `_tag`, and `pkgrel`.
+4. Recomputes checksums with `updpkgsums`.
+5. Builds the package with `makepkg -s` (which runs `prepare()`, `build()`,
+   `check()`, and `package()`).
+6. Generates `.SRCINFO` and validates with `namcap`.
+7. Pushes the updated PKGBUILD and .SRCINFO to the AUR git repo via SSH.
+
+## Version Auto-Increment
+
+The workflow fetches the current AUR version before building. The version
+comparison logic:
+
+- **Same `pkgver`**: increment `pkgrel` (e.g., `0.2.2-1` becomes `0.2.2-2`)
+- **New `pkgver`**: reset `pkgrel` to `1` (e.g., `0.3.0-1`)
+
+This ensures re-running the workflow for the same tag always produces a
+publishable update without manual intervention.
+
+## Local Testing
+
+To test the PKGBUILD locally on an Arch Linux system:
+
+```bash
+cd packaging/aur
+makepkg -s --noconfirm
+namcap PKGBUILD
+namcap *.pkg.tar.*
+```
+
+See [PACKAGING.md](../../PACKAGING.md) for full setup and secrets
+configuration.